145 lines · c
1// SPDX-License-Identifier: GPL-2.0+2//3// Copyright 2019, Michael Ellerman, IBM Corp.4//5// Test that out-of-bounds reads/writes behave as expected.6 7#include <setjmp.h>8#include <stdbool.h>9#include <stdio.h>10#include <stdlib.h>11#include <string.h>12#include <sys/types.h>13#include <sys/wait.h>14#include <unistd.h>15 16#include "utils.h"17 18// Old distros (Ubuntu 16.04 at least) don't define this19#ifndef SEGV_BNDERR20#define SEGV_BNDERR 321#endif22 23// 64-bit kernel is always here24#define PAGE_OFFSET (0xcul << 60)25 26static unsigned long kernel_virt_end;27 28static volatile int fault_code;29static volatile unsigned long fault_addr;30static jmp_buf setjmp_env;31 32static void segv_handler(int n, siginfo_t *info, void *ctxt_v)33{34 fault_code = info->si_code;35 fault_addr = (unsigned long)info->si_addr;36 siglongjmp(setjmp_env, 1);37}38 39int bad_access(char *p, bool write)40{41 char x = 0;42 43 fault_code = 0;44 fault_addr = 0;45 46 if (sigsetjmp(setjmp_env, 1) == 0) {47 if (write)48 *p = 1;49 else50 x = *p;51 52 printf("Bad - no SEGV! (%c)\n", x);53 return 1;54 }55 56 // If we see MAPERR that means we took a page fault rather than an SLB57 // miss. We only expect to take page faults for addresses within the58 // valid kernel range.59 FAIL_IF(fault_code == SEGV_MAPERR && \60 (fault_addr < PAGE_OFFSET || fault_addr >= kernel_virt_end));61 62 FAIL_IF(fault_code != SEGV_MAPERR && fault_code != SEGV_BNDERR);63 64 return 0;65}66 67static int test(void)68{69 unsigned long i, j, addr, region_shift, page_shift, page_size;70 struct sigaction sig;71 bool hash_mmu;72 73 sig = (struct sigaction) {74 .sa_sigaction = segv_handler,75 .sa_flags = SA_SIGINFO,76 };77 78 FAIL_IF(sigaction(SIGSEGV, &sig, NULL) != 0);79 80 FAIL_IF(using_hash_mmu(&hash_mmu));81 82 page_size = sysconf(_SC_PAGESIZE);83 if (page_size == (64 * 1024))84 page_shift = 16;85 else86 page_shift = 12;87 88 if (page_size == (64 * 1024) || !hash_mmu) {89 region_shift = 52;90 91 // We have 7 512T regions (4 kernel linear, vmalloc, io, vmemmap)92 kernel_virt_end = PAGE_OFFSET + (7 * (512ul << 40));93 } else if (page_size == (4 * 1024) && hash_mmu) {94 region_shift = 46;95 96 // We have 7 64T regions (4 kernel linear, vmalloc, io, vmemmap)97 kernel_virt_end = PAGE_OFFSET + (7 * (64ul << 40));98 } else99 FAIL_IF(true);100 101 printf("Using %s MMU, PAGE_SIZE = %dKB start address 0x%016lx\n",102 hash_mmu ? "hash" : "radix",103 (1 << page_shift) >> 10,104 1ul << region_shift);105 106 // This generates access patterns like:107 // 0x0010000000000000108 // 0x0010000000010000109 // 0x0010000000020000110 // ...111 // 0x0014000000000000112 // 0x0018000000000000113 // 0x0020000000000000114 // 0x0020000000010000115 // 0x0020000000020000116 // ...117 // 0xf400000000000000118 // 0xf800000000000000119 120 for (i = 1; i <= ((0xful << 60) >> region_shift); i++) {121 for (j = page_shift - 1; j < 60; j++) {122 unsigned long base, delta;123 124 base = i << region_shift;125 delta = 1ul << j;126 127 if (delta >= base)128 break;129 130 addr = (base | delta) & ~((1 << page_shift) - 1);131 132 FAIL_IF(bad_access((char *)addr, false));133 FAIL_IF(bad_access((char *)addr, true));134 }135 }136 137 return 0;138}139 140int main(void)141{142 test_harness_set_timeout(300);143 return test_harness(test, "bad_accesses");144}145